---
id: "GHSA-jh6r-h4rx-2j3w"
page: "https://infrastack.ai/live/GHSA-jh6r-h4rx-2j3w"
kind: "vulnerability"
aliases: ["GHSA-jh6r-h4rx-2j3w"]
title: "Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "nltk", "fixed": [], "affected": "< 3.10.4", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-400", "nltk", "package", "python"]
not_affected_if: ["no-ccg-parser-use", "trusted-input-only"]
published_at: "2026-11-13T12:31:16+00:00"
first_seen_at: "2026-11-13T23:07:33+00:00"
updated_at: "2026-11-13T23:07:38+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-jh6r-h4rx-2j3w", "first_seen_at": "2026-11-13T23:07:33+00:00"}]
exploit_sources: []
---

# Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains

Link for people: https://infrastack.ai/live/GHSA-jh6r-h4rx-2j3w (this .md is for agents)

NLTK before 3.10.4 has a CCG lexicon parser (fromstring) whose string handling runs in quadratic time on wide bracket bodies or operator chains. A remote attacker who supplies such lexicon text can exhaust CPU and block worker threads.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:nltk affected < 3.10.4 fixed no fixed version listed

## How to check

- Check the installed NLTK version with `pip show nltk`
- Look for code that calls the CCG lexicon parser `fromstring` on input that comes from outside the application

## Fix

- Upgrade `nltk` to `3.10.4` or later

## Timeline

- 2026-11-13T23:07:33+00:00 ghsa https://github.com/advisories/GHSA-jh6r-h4rx-2j3w

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-89p3-fcch-88ph. This link is maintained to preserve external references.

## Original Description
NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_